fix: job container, daemon startup, action cache and exec fixes (#1294)

- Keep `GITHUB_ENV`, `GITHUB_OUTPUT`, `GITHUB_STATE` and `GITHUB_PATH` when a job times out or is cancelled, so post steps still get their state
- Retry the startup Declare while Gitea is unreachable instead of exiting, still failing fast on rejected registrations, auth and misconfiguration
- Reuse a local image when a platform variant such as `linux/arm/v7` is requested instead of pulling again
- Read `PATH` from the created job container so cross-architecture jobs get tool paths for the right architecture
- Extract action copies relative to the act volume so they never cross an image's `/var/run` symlink, which rootless Podman rejects
- Keep the job container's entrypoint when container options set `--entrypoint`, warning instead of appending it to the keep-alive command
- Lock action cache entries across runner processes that share a cache directory
- `exec`: omit `GITHUB_SERVER_URL` and `GITHUB_API_URL` without `--gitea-instance` instead of exporting a bare `https://`, and read owner and repository from any origin remote

Reviewed-on: https://gitea.com/gitea/runner/pulls/1294
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>

internal/app/cmd/daemon.go

@@ -5,8 +5,10 @@ package cmd
 
 import (
 	"context"
+	"crypto/tls"
 	"errors"
 	"fmt"
+	"net/http"
 	"os"
 	"path"
 	"path/filepath"
@@ -29,6 +31,8 @@ import (
 	"gitea.com/gitea/runner/internal/pkg/ver"
 
 	"connectrpc.com/connect"
+	runnerv1 "gitea.dev/actionslib/runner/v1"
+	"github.com/avast/retry-go/v5"
 	"github.com/mattn/go-isatty"
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
@@ -185,8 +189,25 @@ func runDaemon(ctx context.Context, daemArgs *daemonArgs, configFile *string) fu
 		}()
 
 		// declare the labels of the runner before fetching tasks
-		resp, err := runner.Declare(ctx, ls.Names())
+		resp, err := retry.NewWithData[*connect.Response[runnerv1.DeclareResponse]](
+			retry.Context(ctx),
+			retry.UntilSucceeded(),
+			retry.Delay(declareRetryDelay),
+			retry.DelayType(retry.FixedDelay),
+			retry.RetryIf(shouldRetryDeclare),
+			retry.OnRetry(func(attempt uint, err error) {
+				if attempt == 0 {
+					log.WithError(err).Warn("fail to invoke Declare, retrying until Gitea is reachable")
+				} else {
+					log.WithError(err).Debug("fail to invoke Declare, retrying")
+				}
+			}),
+		).Do(func() (*connect.Response[runnerv1.DeclareResponse], error) {
+			return runner.Declare(ctx, ls.Names())
+		})
 		switch {
+		case err != nil && ctx.Err() != nil && !client.IsRegistrationRejected(err):
+			return nil
 		case err != nil && connect.CodeOf(err) == connect.CodeUnimplemented:
 			log.Errorf("Your Gitea version is too old to support runner declare, please upgrade to v1.21 or later")
 			return err
@@ -352,6 +373,20 @@ func initLogging(cfg *config.Config) {
 	}
 }
 
+var declareRetryDelay = 30 * time.Second
+
+func shouldRetryDeclare(err error) bool {
+	if errors.As(err, new(*tls.CertificateVerificationError)) || errors.As(err, new(tls.AlertError)) || errors.Is(err, http.ErrSchemeMismatch) { // misconfigurations never heal
+		return false
+	}
+	switch connect.CodeOf(err) {
+	case connect.CodeUnauthenticated, connect.CodeUnimplemented, connect.CodePermissionDenied, connect.CodeInvalidArgument:
+		return false
+	default:
+		return !client.IsRegistrationRejected(err)
+	}
+}
+
 var commonSocketPaths = []string{
 	"/var/run/docker.sock",
 	"/run/podman/podman.sock",